ASHRAE 188 is the national standard that requires building owners to control Legionella risk in water systems through a formal, written water management plan. It doesn’t prescribe exact temperatures or chemical levels — it requires you to identify your risks, set your own control limits, monitor them, and document everything.
On this page
- What ASHRAE 188 requires
- Who needs a water management plan
- The 7 elements of a compliant plan
- CMS S&C 17-30: why surveyors ask about it
- Control measures that actually work
- ASHRAE 188 vs. Guideline 12
- Common survey deficiencies
- Frequently asked questions
What ASHRAE 188 requires
ANSI/ASHRAE Standard 188-2021 establishes minimum legionellosis risk management requirements for the design, construction, commissioning, operation, maintenance, repair, and expansion of building water systems — both potable and non-potable. The 2021 edition replaced permissive language with enforceable language specifically so the standard can be adopted into codes and regulations.
The core requirement is a Water Management Program (WMP): a living, documented plan owned by a designated team. The standard is a framework, not a recipe — it tells you what the plan must address, while your program team decides the specific policies, control limits, and procedures that fit your building.
Who needs a water management plan
Under ASHRAE 188, a WMP is required for buildings where a survey identifies heightened risk — which in practice captures nearly every hospital. Risk factors include:
- Healthcare facilities with inpatient beds, transplant units, oncology, or ICUs
- Buildings with cooling towers, decorative fountains, or other aerosol-generating devices
- Central hot-water systems serving multiple housing units
- Buildings over 10 stories
- Facilities housing immunocompromised occupants
Separately, CMS requires it regardless of the survey outcome (see below) — if you’re Medicare-certified, you need the plan.
The 7 elements of a compliant plan
The CDC’s toolkit — the practical companion CMS points facilities to — organizes a water management program into seven steps:
- Establish a water management program team. Multidisciplinary: facilities/engineering, infection prevention, administration, and often an outside water-treatment vendor. Someone owns it by name.
- Describe the building water systems. Written description plus flow diagrams: potable hot and cold, cooling towers, fountains, ice machines, hydrotherapy, irrigation — anywhere water sits or moves.
- Identify where Legionella could grow. Hazard analysis: dead legs, low-flow areas, tepid water zones, inadequate disinfectant residual, areas downstream of construction.
- Decide control measures and how to monitor them. For each hazard: what control applies, what the control limit is, and how you’ll check it (temperature logs, disinfectant residual tests, visual inspections).
- Establish corrective actions. Pre-defined responses for when a control limit is missed — flushing protocols, shock disinfection, equipment repair — so staff act instead of improvising.
- Verify the program works as designed. Routine checks that monitoring is actually happening and control measures are effective.
- Document and communicate. Everything above in writing, current, and accessible to the team — and to surveyors.
CMS S&C 17-30: why surveyors ask about it
On June 2, 2017, CMS issued memorandum S&C 17-30 (Hospitals/CAHs/Nursing Homes): Requirement to Reduce Legionella Risk in Healthcare Facility Water Systems. It requires Medicare-certified healthcare facilities to have water management policies and procedures that reduce the risk of Legionella and other opportunistic waterborne pathogens.
The memo doesn’t hand you a procedure manual — it points you at ASHRAE 188 and the CDC toolkit as the framework and expects your program to consider both. Surveyors are instructed to review whether the facility has implemented an effective program. In practice, “we follow ASHRAE 188” with documentation to prove it is the answer surveyors want to hear. For more on how construction activity disturbs water systems specifically, see our guide to water system risks during healthcare construction.
Control measures that actually work
Most hospital WMPs converge on the same handful of controls, because Legionella biology is consistent — it thrives in warm, stagnant water with biofilm and little disinfectant:
- Temperature management — keeping hot water hot and cold water cold throughout the distribution system, with no tepid zones.
- Disinfectant residual — maintaining measurable disinfectant (e.g., chlorine/chloramine) at distal outlets.
- Flushing programs — routine flushing of low-use outlets, dead legs, and areas affected by construction or low occupancy.
- Equipment maintenance — cleaning and disinfecting cooling towers, ice machines, showerheads, and storage tanks on schedule.
- Construction coordination — water disruptions during renovation get their own risk assessment, since pressure drops and stagnation seed colonization.
ASHRAE 188 vs. Guideline 12
ASHRAE 188 is the requirement; Guideline 12-2023 is the how-to. Standard 188 is written in enforceable code language — it says what you must do. Guideline 12 (Managing the Risk of Legionellosis Associated with Building Water Systems) is the companion that gives system-specific, prescriptive guidance: potable systems, cooling towers, fountains, spas, humidifiers, monitoring methods, even PPE considerations. Use 188 to satisfy the surveyor; use Guideline 12 to actually run the program.
Note the naming trap: ASHRAE 188 covers water; ASHRAE 170 covers air. They’re different standards for different risks — our ASHRAE 170 ventilation guide covers the air side.
Common survey deficiencies
- No written plan at all — verbal assurances don’t survive a surveyor’s document request.
- A plan nobody owns — no named team, no assignments, no accountability.
- No flow diagrams — the team can’t describe the system they’re managing.
- Monitoring without control limits — logging temperatures nobody evaluates against a threshold.
- Stale documentation — a 2019 plan that predates two renovations and a cooling tower replacement.
- Construction blind spot — water disruptions during projects handled ad hoc instead of through the WMP.
Frequently asked questions
Does CMS require ASHRAE 188 specifically?
CMS S&C 17-30 requires Medicare-certified facilities to have water management policies and procedures, and directs them to consider ASHRAE 188 and the CDC toolkit as the framework. You won’t be cited for “not owning a copy of Standard 188” — you’ll be cited for not having an effective program, and 188 is the yardstick surveyors measure it against.
Does ASHRAE 188 require routine Legionella testing?
Not as a standing mandate. The standard requires monitoring of your control measures (temperature, disinfectant residual, etc.). Environmental testing for Legionella enters the picture when control limits are repeatedly missed, after corrective actions, or when cases are suspected — the CDC toolkit and CMS both discuss when testing is warranted.
Who should be on the water management team?
At minimum: facilities/engineering leadership, infection prevention, and administration. Most hospitals also include their water-treatment vendor and, during projects, construction management. One person should own the program by name.
How often should the plan be reviewed?
At least annually — and after any significant change: renovations, cooling tower work, water service disruptions, new wings, or a Legionella detection. A plan that doesn’t reflect the current building is a plan that fails surveys.
Informational summary only — verify requirements against the current edition of ASHRAE 188 and applicable CMS guidance. This page does not reproduce copyrighted standard text.